Fix-CVE-2023-36884

Fix-CVE-2023-36884.ps1 Temporary solution to mitigate the vulnerability CVE-2023-36884. This vulnerability affects the Windows operating system and may allow remote code execution. CVE-2023-36884 » CVE-2023-36884 The CVE-2023-36884 vulnerability, which is a critical security flaw that can result ...

MemProcFS-Analyzer

MemProcFS-Analyzer MemProcFS-Analyzer.ps1 is a PowerShell script utilized to simplify the usage of MemProcFS and to optimize your memory analysis workflow. MemProcFS - The Memory Process File System by Ulf Frisk https://github.com/ufrisk/MemProcFS Features: Fast and easy memory analysis! You can...

CVE-2023-36884-Checker

CVE-2023-36884-Checker Script to check for CVE-2023-36884 hardening https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884 Goal This scripts checks if Microsoft hardening recommendations are properly applied. Microsoft says...

PrivescCheck

PrivescCheck Quickly identify common Windows vulnerabilities and configuration issues that are not necessarily covered by public security standards, and collect useful information for exploitation and post-exploitation tasks. !IMPORTANT A major aspect to be aware of when using this tool is that a...

CredsLeaker

CredsLeaker v4.x A big shoutout to @ApSecDev who took this project to the next level! Kudos! This script used to display a powershell credentials box asked the user for credentials. However, That was highly noticeable. Now it's time to utilize Windows Security popup! Features AD domain...

CVE-2021-36934

CVE-2021-36934 Usage Detection .\Get-HiveNightmareStatus.ps1 Detection for management tools that need True/False output .\Get-HiveNightmareStatus.ps1 -PostureCheck Remediation For initial SAM fixes and vss removal .\Get-HiveNightmareStatus.ps1 -Remediate Remediate even if the checks say healthy o...

Yellowkey-mitigation

Yellowkey-mitigation.ps1 is a PowerShell script that automates the WinRE mitigation workflow described in CVE-2026-45585, adds verification after every step, and does not execute step 6 reagentc /disable + reagentc /enable if any earlier step fails. It also checks whether the required registry...

CVE-2019-0708-Check-Device-Patch-Status

CVE-2019-0708-Vulnerability-Scanner Powershell script to run and determine if a specific device has been patched for CVE-2019-0708. This checks to see if the termdd.sys file has been updated appropriate and is at a version level at or greater than the versions released in the 5/14/19 patches. All...

Win-PortFwd

Win-PortFwd Powershell script to setup windows port forwarding using native netsh client Install: git clone https://github.com/deepzec/Win-PortFwd.git Usage: .\win-portfwd.ps1 or powershell.exe -noprofile -executionpolicy bypass -file .\win-portfwd.ps1 Example : Note: This script require admin...

Get-AppLockerEventlog

Get-AppLockerEventlog DESCRIPTION This script will parse all the channels of events from the win-event log to extract all the log relatives to AppLocker. The script will gather all the important pieces of information relative to the events for forensic or threat-hunting purposes, or even in order...

CyberPipe

CyberPipe v5.3 formerly CSIRT-Collect An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations. Functions: 🐏 Capture a memory image with MAGNET DumpIt supports x86, x64, and ARM64 or MAGNET RAM Capture for legacy systems. 💻 Collect triage data using MAGNET...

Invoke-EDRChecker

Invoke-EDRChecker The script will check running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services, the registry and running drivers for the presence of known defensive products such as AV's, EDR's and...

Orchestrated-Powershell-for-CVE-2023-24932-en

Secure Boot Mitigation Orchestrator Script Overview This PowerShell script automates the Secure Boot mitigation steps for CVE-2023-24932 , as outlined in the Microsoft Security Guidance. It handles the entire process, including registry updates, reboots, and event log validation, to ensure your...

CVE-2020-16898_Check

CVE-2020-16898Check Minor powershell script that checks for vulnerable interfaces...

CVE-2022-41099-Fix

I take no Liability & Warranty on this script please fully test before use. CVE-2022-41099-Fix Update WINRE.WIM file to fix CVE-2022-41099 REF: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41099 Microsoft Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=kb5022282...

CVE-2022-47966_checker

CVE-2022-47966checker Quick and dirty powershell script to look for ManageEngine CVE-2022-47966 IOCs. The script will parse requests in ME HTTP access logs. If a characteristic SAML request is found, it will attempt to decode and extract the attacker's payload. Findings are written to...

Compromised-Org-Chart-Generator

Compromised Org Chart Generator Overview Active Directory is used by organization as the identity provider. It contains information of all employees including their names, job titles, departments, and their managers. Password audits can help to discover weaknesses and risks. You might try passwor...

WinRE-Fix

WinRE-Fix PowerShell script to safely move/recreate Windows Recovery Environment WinRE to a new Recovery partition. Keywords: WinRE Windows Recovery Recovery Partition reagentc KB5034441 KB5028997 CVE-2024-20666 BitLocker Windows Update Fix Partition Resize GPT UEFI 🎯 What This Script Solves This...

antivmdetection

Antivmdetection Background A script to help you create templates, which you can use with VirtualBox to make VM detection harder. My first post on the subject was in 2012 and have after that been updated at random times. The blog format might have not been the best way of publishing the informatio...

Douglas-042

Douglas-042 - Threat Hunting Incident Response - PowerShell Hunting DOUGLAS-042 stands as an ingenious embodiment of a PowerShell script meticulously designed to expedite the triage process and facilitate the meticulous collection of crucial evidence derived from both forensic artifacts and the...